AWS services or capabilities described in AWS Documentation may vary by region/location. Click Getting Started with Amazon AWS to see specific differences applicable to the China (Beijing) Region.

IAmazonWAF

Interface

Search:

Interface for accessing WAF
This is the AWS WAF API Reference for using AWS WAF with Amazon CloudFront.
The AWS WAF actions and data types listed in the reference are available for protecting
Amazon CloudFront distributions. You can use these actions and data types via the
endpoint waf.amazonaws.com. This guide is for developers who need detailed
information about the AWS WAF API actions, data types, and errors. For detailed information
about AWS WAF features and an overview of how to use the AWS WAF API, see the AWS
WAF Developer Guide.

Inheritance Hierarchy

Amazon.WAF.IAmazonWAF

Namespace: Amazon.WAFAssembly: AWSSDK.WAF.dllVersion: 3.x.y.z

Syntax

Methods

Name

Description

Note:

Asynchronous operations (methods ending with Async) in the table below are for .NET 4.5 or higher. For .NET 3.5 the SDK follows the standard naming convention of BeginMethodName and EndMethodName to indicate asynchronous operations - these method pairs are not shown in the table below.

Creates a ByteMatchSet. You then use UpdateByteMatchSet to identify
the part of a web request that you want AWS WAF to inspect, such as the values of
the User-Agent header or the query string. For example, you can create
a ByteMatchSet that matches any requests with User-Agent
headers that contain the string BadBot. You can then configure AWS WAF
to reject those requests.

To create and configure a ByteMatchSet, perform the following steps:

Use GetChangeToken to get the change token that you provide in the ChangeToken
parameter of a CreateByteMatchSet request.

Submit a CreateByteMatchSet request.

Use GetChangeToken to get the change token that you provide in the ChangeToken
parameter of an UpdateByteMatchSet request.

Submit an UpdateByteMatchSet request to specify the part of the request that
you want AWS WAF to inspect (for example, the header or the URI) and the value that
you want AWS WAF to watch for.

For more information about how to use the AWS WAF API to allow or block HTTP requests,
see the AWS WAF Developer
Guide.

Creates a ByteMatchSet. You then use UpdateByteMatchSet to identify
the part of a web request that you want AWS WAF to inspect, such as the values of
the User-Agent header or the query string. For example, you can create
a ByteMatchSet that matches any requests with User-Agent
headers that contain the string BadBot. You can then configure AWS WAF
to reject those requests.

To create and configure a ByteMatchSet, perform the following steps:

Use GetChangeToken to get the change token that you provide in the ChangeToken
parameter of a CreateByteMatchSet request.

Submit a CreateByteMatchSet request.

Use GetChangeToken to get the change token that you provide in the ChangeToken
parameter of an UpdateByteMatchSet request.

Submit an UpdateByteMatchSet request to specify the part of the request that
you want AWS WAF to inspect (for example, the header or the URI) and the value that
you want AWS WAF to watch for.

For more information about how to use the AWS WAF API to allow or block HTTP requests,
see the AWS WAF Developer
Guide.

Creates a ByteMatchSet. You then use UpdateByteMatchSet to identify
the part of a web request that you want AWS WAF to inspect, such as the values of
the User-Agent header or the query string. For example, you can create
a ByteMatchSet that matches any requests with User-Agent
headers that contain the string BadBot. You can then configure AWS WAF
to reject those requests.

To create and configure a ByteMatchSet, perform the following steps:

Use GetChangeToken to get the change token that you provide in the ChangeToken
parameter of a CreateByteMatchSet request.

Submit a CreateByteMatchSet request.

Use GetChangeToken to get the change token that you provide in the ChangeToken
parameter of an UpdateByteMatchSet request.

Submit an UpdateByteMatchSet request to specify the part of the request that
you want AWS WAF to inspect (for example, the header or the URI) and the value that
you want AWS WAF to watch for.

For more information about how to use the AWS WAF API to allow or block HTTP requests,
see the AWS WAF Developer
Guide.

Creates an IPSet, which you use to specify which web requests you want to allow
or block based on the IP addresses that the requests originate from. For example,
if you're receiving a lot of requests from one or more individual IP addresses or
one or more ranges of IP addresses and you want to block the requests, you can create
an IPSet that contains those IP addresses and then configure AWS WAF
to block the requests.

To create and configure an IPSet, perform the following steps:

Use GetChangeToken to get the change token that you provide in the ChangeToken
parameter of a CreateIPSet request.

Submit a CreateIPSet request.

Use GetChangeToken to get the change token that you provide in the ChangeToken
parameter of an UpdateIPSet request.

Submit an UpdateIPSet request to specify the IP addresses that you want
AWS WAF to watch for.

For more information about how to use the AWS WAF API to allow or block HTTP requests,
see the AWS WAF Developer
Guide.

Creates an IPSet, which you use to specify which web requests you want to allow
or block based on the IP addresses that the requests originate from. For example,
if you're receiving a lot of requests from one or more individual IP addresses or
one or more ranges of IP addresses and you want to block the requests, you can create
an IPSet that contains those IP addresses and then configure AWS WAF
to block the requests.

To create and configure an IPSet, perform the following steps:

Use GetChangeToken to get the change token that you provide in the ChangeToken
parameter of a CreateIPSet request.

Submit a CreateIPSet request.

Use GetChangeToken to get the change token that you provide in the ChangeToken
parameter of an UpdateIPSet request.

Submit an UpdateIPSet request to specify the IP addresses that you want
AWS WAF to watch for.

For more information about how to use the AWS WAF API to allow or block HTTP requests,
see the AWS WAF Developer
Guide.

Creates an IPSet, which you use to specify which web requests you want to allow
or block based on the IP addresses that the requests originate from. For example,
if you're receiving a lot of requests from one or more individual IP addresses or
one or more ranges of IP addresses and you want to block the requests, you can create
an IPSet that contains those IP addresses and then configure AWS WAF
to block the requests.

To create and configure an IPSet, perform the following steps:

Use GetChangeToken to get the change token that you provide in the ChangeToken
parameter of a CreateIPSet request.

Submit a CreateIPSet request.

Use GetChangeToken to get the change token that you provide in the ChangeToken
parameter of an UpdateIPSet request.

Submit an UpdateIPSet request to specify the IP addresses that you want
AWS WAF to watch for.

For more information about how to use the AWS WAF API to allow or block HTTP requests,
see the AWS WAF Developer
Guide.

Creates a RateBasedRule. The RateBasedRule contains a RateLimit,
which specifies the maximum number of requests that AWS WAF allows from a specified
IP address in a five-minute period. The RateBasedRule also contains the
IPSet objects, ByteMatchSet objects, and other predicates
that identify the requests that you want to count or block if these requests exceed
the RateLimit.

If you add more than one predicate to a RateBasedRule, a request not
only must exceed the RateLimit, but it also must match all the specifications
to be counted or blocked. For example, suppose you add the following to a RateBasedRule:

An IPSet that matches the IP address 192.0.2.44/32

A ByteMatchSet that matches BadBot in the User-Agent
header

Further, you specify a RateLimit of 15,000.

You then add the RateBasedRule to a WebACL and specify that
you want to block requests that meet the conditions in the rule. For a request to
be blocked, it must come from the IP address 192.0.2.44 and the User-Agent
header in the request must contain the value BadBot. Further, requests
that match these two conditions must be received at a rate of more than 15,000 requests
every five minutes. If both conditions are met and the rate is exceeded, AWS WAF blocks
the requests. If the rate drops below 15,000 for a five-minute period, AWS WAF no
longer blocks the requests.

As a second example, suppose you want to limit requests to a particular page on your
site. To do this, you could add the following to a RateBasedRule:

A ByteMatchSet with FieldToMatch of URI

A PositionalConstraint of STARTS_WITH

A TargetString of login

Further, you specify a RateLimit of 15,000.

By adding this RateBasedRule to a WebACL, you could limit
requests to your login page without affecting the rest of your site.

Creates a Rule, which contains the IPSet objects, ByteMatchSet
objects, and other predicates that identify the requests that you want to block. If
you add more than one predicate to a Rule, a request must match all of
the specifications to be allowed or blocked. For example, suppose you add the following
to a Rule:

An IPSet that matches the IP address 192.0.2.44/32

A ByteMatchSet that matches BadBot in the User-Agent
header

You then add the Rule to a WebACL and specify that you want
to blocks requests that satisfy the Rule. For a request to be blocked,
it must come from the IP address 192.0.2.44 and the User-Agent
header in the request must contain the value BadBot.

Creates a Rule, which contains the IPSet objects, ByteMatchSet
objects, and other predicates that identify the requests that you want to block. If
you add more than one predicate to a Rule, a request must match all of
the specifications to be allowed or blocked. For example, suppose you add the following
to a Rule:

An IPSet that matches the IP address 192.0.2.44/32

A ByteMatchSet that matches BadBot in the User-Agent
header

You then add the Rule to a WebACL and specify that you want
to blocks requests that satisfy the Rule. For a request to be blocked,
it must come from the IP address 192.0.2.44 and the User-Agent
header in the request must contain the value BadBot.

Creates a Rule, which contains the IPSet objects, ByteMatchSet
objects, and other predicates that identify the requests that you want to block. If
you add more than one predicate to a Rule, a request must match all of
the specifications to be allowed or blocked. For example, suppose you add the following
to a Rule:

An IPSet that matches the IP address 192.0.2.44/32

A ByteMatchSet that matches BadBot in the User-Agent
header

You then add the Rule to a WebACL and specify that you want
to blocks requests that satisfy the Rule. For a request to be blocked,
it must come from the IP address 192.0.2.44 and the User-Agent
header in the request must contain the value BadBot.

Creates a SizeConstraintSet. You then use UpdateSizeConstraintSet
to identify the part of a web request that you want AWS WAF to check for length, such
as the length of the User-Agent header or the length of the query string.
For example, you can create a SizeConstraintSet that matches any requests
that have a query string that is longer than 100 bytes. You can then configure AWS
WAF to reject those requests.

To create and configure a SizeConstraintSet, perform the following steps:

Use GetChangeToken to get the change token that you provide in the ChangeToken
parameter of a CreateSizeConstraintSet request.

Submit a CreateSizeConstraintSet request.

Use GetChangeToken to get the change token that you provide in the ChangeToken
parameter of an UpdateSizeConstraintSet request.

Submit an UpdateSizeConstraintSet request to specify the part of the request
that you want AWS WAF to inspect (for example, the header or the URI) and the value
that you want AWS WAF to watch for.

For more information about how to use the AWS WAF API to allow or block HTTP requests,
see the AWS WAF Developer
Guide.

Creates a SqlInjectionMatchSet, which you use to allow, block, or count requests
that contain snippets of SQL code in a specified part of web requests. AWS WAF searches
for character sequences that are likely to be malicious strings.

To create and configure a SqlInjectionMatchSet, perform the following
steps:

Use GetChangeToken to get the change token that you provide in the ChangeToken
parameter of a CreateSqlInjectionMatchSet request.

Submit a CreateSqlInjectionMatchSet request.

Use GetChangeToken to get the change token that you provide in the ChangeToken
parameter of an UpdateSqlInjectionMatchSet request.

Submit an UpdateSqlInjectionMatchSet request to specify the parts of web requests
in which you want to allow, block, or count malicious SQL code.

For more information about how to use the AWS WAF API to allow or block HTTP requests,
see the AWS WAF Developer
Guide.

Creates a SqlInjectionMatchSet, which you use to allow, block, or count requests
that contain snippets of SQL code in a specified part of web requests. AWS WAF searches
for character sequences that are likely to be malicious strings.

To create and configure a SqlInjectionMatchSet, perform the following
steps:

Use GetChangeToken to get the change token that you provide in the ChangeToken
parameter of a CreateSqlInjectionMatchSet request.

Submit a CreateSqlInjectionMatchSet request.

Use GetChangeToken to get the change token that you provide in the ChangeToken
parameter of an UpdateSqlInjectionMatchSet request.

Submit an UpdateSqlInjectionMatchSet request to specify the parts of web requests
in which you want to allow, block, or count malicious SQL code.

For more information about how to use the AWS WAF API to allow or block HTTP requests,
see the AWS WAF Developer
Guide.

Creates a SqlInjectionMatchSet, which you use to allow, block, or count requests
that contain snippets of SQL code in a specified part of web requests. AWS WAF searches
for character sequences that are likely to be malicious strings.

To create and configure a SqlInjectionMatchSet, perform the following
steps:

Use GetChangeToken to get the change token that you provide in the ChangeToken
parameter of a CreateSqlInjectionMatchSet request.

Submit a CreateSqlInjectionMatchSet request.

Use GetChangeToken to get the change token that you provide in the ChangeToken
parameter of an UpdateSqlInjectionMatchSet request.

Submit an UpdateSqlInjectionMatchSet request to specify the parts of web requests
in which you want to allow, block, or count malicious SQL code.

For more information about how to use the AWS WAF API to allow or block HTTP requests,
see the AWS WAF Developer
Guide.

Creates a WebACL, which contains the Rules that identify
the CloudFront web requests that you want to allow, block, or count. AWS WAF evaluates
Rules in order based on the value of Priority for each Rule.

You also specify a default action, either ALLOW or BLOCK.
If a web request doesn't match any of the Rules in a WebACL,
AWS WAF responds to the request with the default action.

Creates an XssMatchSet, which you use to allow, block, or count requests that
contain cross-site scripting attacks in the specified part of web requests. AWS WAF
searches for character sequences that are likely to be malicious strings.

To create and configure an XssMatchSet, perform the following steps:

Use GetChangeToken to get the change token that you provide in the ChangeToken
parameter of a CreateXssMatchSet request.

Submit a CreateXssMatchSet request.

Use GetChangeToken to get the change token that you provide in the ChangeToken
parameter of an UpdateXssMatchSet request.

Submit an UpdateXssMatchSet request to specify the parts of web requests in
which you want to allow, block, or count cross-site scripting attacks.

For more information about how to use the AWS WAF API to allow or block HTTP requests,
see the AWS WAF Developer
Guide.

When you want to create, update, or delete AWS WAF objects, get a change token and
include the change token in the create, update, or delete request. Change tokens ensure
that your application doesn't submit conflicting requests to AWS WAF.

Each create, update, or delete request must use a unique change token. If your application
submits a GetChangeToken request and then submits a second GetChangeToken
request before submitting a create, update, or delete request, the second GetChangeToken
request returns the same value as the first GetChangeToken request.

When you use a change token in a create, update, or delete request, the status of
the change token changes to PENDING, which indicates that AWS WAF is
propagating the change to all AWS WAF servers. Use GetChangeTokenStatus
to determine the status of your change token.

When you want to create, update, or delete AWS WAF objects, get a change token and
include the change token in the create, update, or delete request. Change tokens ensure
that your application doesn't submit conflicting requests to AWS WAF.

Each create, update, or delete request must use a unique change token. If your application
submits a GetChangeToken request and then submits a second GetChangeToken
request before submitting a create, update, or delete request, the second GetChangeToken
request returns the same value as the first GetChangeToken request.

When you use a change token in a create, update, or delete request, the status of
the change token changes to PENDING, which indicates that AWS WAF is
propagating the change to all AWS WAF servers. Use GetChangeTokenStatus
to determine the status of your change token.

When you want to create, update, or delete AWS WAF objects, get a change token and
include the change token in the create, update, or delete request. Change tokens ensure
that your application doesn't submit conflicting requests to AWS WAF.

Each create, update, or delete request must use a unique change token. If your application
submits a GetChangeToken request and then submits a second GetChangeToken
request before submitting a create, update, or delete request, the second GetChangeToken
request returns the same value as the first GetChangeToken request.

When you use a change token in a create, update, or delete request, the status of
the change token changes to PENDING, which indicates that AWS WAF is
propagating the change to all AWS WAF servers. Use GetChangeTokenStatus
to determine the status of your change token.

Returns an array of IP addresses currently being blocked by the RateBasedRule
that is specified by the RuleId. The maximum number of managed keys that
will be blocked is 10,000. If more than 10,000 addresses exceed the rate limit, the
10,000 addresses with the highest rates will be blocked.

Gets detailed information about a specified number of requests--a sample--that AWS
WAF randomly selects from among the first 5,000 requests that your AWS resource received
during a time range that you choose. You can specify a sample size of up to 500 requests,
and you can specify any time range in the previous three hours.

GetSampledRequests returns a time range, which is usually the time range
that you specified. However, if your resource (such as a CloudFront distribution)
received 5,000 requests before the specified time range elapsed, GetSampledRequests
returns an updated time range. This new time range indicates the actual period during
which AWS WAF selected the requests in the sample.

Inserts or deletes ByteMatchTuple objects (filters) in a ByteMatchSet.
For each ByteMatchTuple object, you specify the following values:

Whether to insert or delete the object from the array. If you want to change a ByteMatchSetUpdate
object, you delete the existing object and add a new one.

The part of a web request that you want AWS WAF to inspect, such as a query string
or the value of the User-Agent header.

The bytes (typically a string that corresponds with ASCII characters) that you want
AWS WAF to look for. For more information, including how you specify the values for
the AWS WAF API and the AWS CLI or SDKs, see TargetString in the ByteMatchTuple
data type.

Where to look, such as at the beginning or the end of a query string.

Whether to perform any conversions on the request, such as converting it to lowercase,
before inspecting it for the specified string.

For example, you can add a ByteMatchSetUpdate object that matches web
requests in which User-Agent headers contain the string BadBot.
You can then configure AWS WAF to block those requests.

Inserts or deletes ByteMatchTuple objects (filters) in a ByteMatchSet.
For each ByteMatchTuple object, you specify the following values:

Whether to insert or delete the object from the array. If you want to change a ByteMatchSetUpdate
object, you delete the existing object and add a new one.

The part of a web request that you want AWS WAF to inspect, such as a query string
or the value of the User-Agent header.

The bytes (typically a string that corresponds with ASCII characters) that you want
AWS WAF to look for. For more information, including how you specify the values for
the AWS WAF API and the AWS CLI or SDKs, see TargetString in the ByteMatchTuple
data type.

Where to look, such as at the beginning or the end of a query string.

Whether to perform any conversions on the request, such as converting it to lowercase,
before inspecting it for the specified string.

For example, you can add a ByteMatchSetUpdate object that matches web
requests in which User-Agent headers contain the string BadBot.
You can then configure AWS WAF to block those requests.

Inserts or deletes ByteMatchTuple objects (filters) in a ByteMatchSet.
For each ByteMatchTuple object, you specify the following values:

Whether to insert or delete the object from the array. If you want to change a ByteMatchSetUpdate
object, you delete the existing object and add a new one.

The part of a web request that you want AWS WAF to inspect, such as a query string
or the value of the User-Agent header.

The bytes (typically a string that corresponds with ASCII characters) that you want
AWS WAF to look for. For more information, including how you specify the values for
the AWS WAF API and the AWS CLI or SDKs, see TargetString in the ByteMatchTuple
data type.

Where to look, such as at the beginning or the end of a query string.

Whether to perform any conversions on the request, such as converting it to lowercase,
before inspecting it for the specified string.

For example, you can add a ByteMatchSetUpdate object that matches web
requests in which User-Agent headers contain the string BadBot.
You can then configure AWS WAF to block those requests.

You use an IPSet to specify which web requests you want to allow or block
based on the IP addresses that the requests originated from. For example, if you're
receiving a lot of requests from one or a small number of IP addresses and you want
to block the requests, you can create an IPSet that specifies those IP
addresses, and then configure AWS WAF to block the requests.

Submit an UpdateIPSet request to specify the IP addresses that you want
AWS WAF to watch for.

When you update an IPSet, you specify the IP addresses that you want
to add and/or the IP addresses that you want to delete. If you want to change an IP
address, you delete the existing IP address and add the new one.

For more information about how to use the AWS WAF API to allow or block HTTP requests,
see the AWS WAF Developer
Guide.

You use an IPSet to specify which web requests you want to allow or block
based on the IP addresses that the requests originated from. For example, if you're
receiving a lot of requests from one or a small number of IP addresses and you want
to block the requests, you can create an IPSet that specifies those IP
addresses, and then configure AWS WAF to block the requests.

Submit an UpdateIPSet request to specify the IP addresses that you want
AWS WAF to watch for.

When you update an IPSet, you specify the IP addresses that you want
to add and/or the IP addresses that you want to delete. If you want to change an IP
address, you delete the existing IP address and add the new one.

For more information about how to use the AWS WAF API to allow or block HTTP requests,
see the AWS WAF Developer
Guide.

You use an IPSet to specify which web requests you want to allow or block
based on the IP addresses that the requests originated from. For example, if you're
receiving a lot of requests from one or a small number of IP addresses and you want
to block the requests, you can create an IPSet that specifies those IP
addresses, and then configure AWS WAF to block the requests.

Submit an UpdateIPSet request to specify the IP addresses that you want
AWS WAF to watch for.

When you update an IPSet, you specify the IP addresses that you want
to add and/or the IP addresses that you want to delete. If you want to change an IP
address, you delete the existing IP address and add the new one.

For more information about how to use the AWS WAF API to allow or block HTTP requests,
see the AWS WAF Developer
Guide.

Inserts or deletes Predicate objects in a rule and updates the RateLimit
in the rule.

Each Predicate object identifies a predicate, such as a ByteMatchSet
or an IPSet, that specifies the web requests that you want to block or count.
The RateLimit specifies the number of requests every five minutes that
triggers the rule.

If you add more than one predicate to a RateBasedRule, a request must
match all the predicates and exceed the RateLimit to be counted or blocked.
For example, suppose you add the following to a RateBasedRule:

An IPSet that matches the IP address 192.0.2.44/32

A ByteMatchSet that matches BadBot in the User-Agent
header

Further, you specify a RateLimit of 15,000.

You then add the RateBasedRule to a WebACL and specify that
you want to block requests that satisfy the rule. For a request to be blocked, it
must come from the IP address 192.0.2.44 and the User-Agent header
in the request must contain the value BadBot. Further, requests that
match these two conditions much be received at a rate of more than 15,000 every five
minutes. If the rate drops below this limit, AWS WAF no longer blocks the requests.

As a second example, suppose you want to limit requests to a particular page on your
site. To do this, you could add the following to a RateBasedRule:

A ByteMatchSet with FieldToMatch of URI

A PositionalConstraint of STARTS_WITH

A TargetString of login

Further, you specify a RateLimit of 15,000.

By adding this RateBasedRule to a WebACL, you could limit
requests to your login page without affecting the rest of your site.

Inserts or deletes Predicate objects in a Rule. Each Predicate
object identifies a predicate, such as a ByteMatchSet or an IPSet, that
specifies the web requests that you want to allow, block, or count. If you add more
than one predicate to a Rule, a request must match all of the specifications
to be allowed, blocked, or counted. For example, suppose you add the following to
a Rule:

A ByteMatchSet that matches the value BadBot in the User-Agent
header

An IPSet that matches the IP address 192.0.2.44

You then add the Rule to a WebACL and specify that you want
to block requests that satisfy the Rule. For a request to be blocked,
the User-Agent header in the request must contain the value BadBotand the request must originate from the IP address 192.0.2.44.

To create and configure a Rule, perform the following steps:

Create and update the predicates that you want to include in the Rule.

Inserts or deletes Predicate objects in a Rule. Each Predicate
object identifies a predicate, such as a ByteMatchSet or an IPSet, that
specifies the web requests that you want to allow, block, or count. If you add more
than one predicate to a Rule, a request must match all of the specifications
to be allowed, blocked, or counted. For example, suppose you add the following to
a Rule:

A ByteMatchSet that matches the value BadBot in the User-Agent
header

An IPSet that matches the IP address 192.0.2.44

You then add the Rule to a WebACL and specify that you want
to block requests that satisfy the Rule. For a request to be blocked,
the User-Agent header in the request must contain the value BadBotand the request must originate from the IP address 192.0.2.44.

To create and configure a Rule, perform the following steps:

Create and update the predicates that you want to include in the Rule.

Inserts or deletes Predicate objects in a Rule. Each Predicate
object identifies a predicate, such as a ByteMatchSet or an IPSet, that
specifies the web requests that you want to allow, block, or count. If you add more
than one predicate to a Rule, a request must match all of the specifications
to be allowed, blocked, or counted. For example, suppose you add the following to
a Rule:

A ByteMatchSet that matches the value BadBot in the User-Agent
header

An IPSet that matches the IP address 192.0.2.44

You then add the Rule to a WebACL and specify that you want
to block requests that satisfy the Rule. For a request to be blocked,
the User-Agent header in the request must contain the value BadBotand the request must originate from the IP address 192.0.2.44.

To create and configure a Rule, perform the following steps:

Create and update the predicates that you want to include in the Rule.

Whether to insert or delete the object from the array. If you want to change a SizeConstraintSetUpdate
object, you delete the existing object and add a new one.

The part of a web request that you want AWS WAF to evaluate, such as the length of
a query string or the length of the User-Agent header.

Whether to perform any transformations on the request, such as converting it to lowercase,
before checking its length. Note that transformations of the request body are not
supported because the AWS resource forwards only the first 8192 bytes
of your request to AWS WAF.

A ComparisonOperator used for evaluating the selected part of the request
against the specified Size, such as equals, greater than, less than,
and so on.

The length, in bytes, that you want AWS WAF to watch for in selected part of the request.
The length is computed after applying the transformation.

For example, you can add a SizeConstraintSetUpdate object that matches
web requests in which the length of the User-Agent header is greater
than 100 bytes. You can then configure AWS WAF to block those requests.

To create and configure a SizeConstraintSet, perform the following steps:

Action: Whether to insert the object into or delete the object from
the array. To change a SqlInjectionMatchTuple, you delete the existing
object and add a new one.

FieldToMatch: The part of web requests that you want AWS WAF to inspect
and, if you want AWS WAF to inspect a header, the name of the header.

TextTransformation: Which text transformation, if any, to perform on
the web request before inspecting the request for snippets of malicious SQL code.

You use SqlInjectionMatchSet objects to specify which CloudFront requests
you want to allow, block, or count. For example, if you're receiving requests that
contain snippets of SQL code in the query string and you want to block the requests,
you can create a SqlInjectionMatchSet with the applicable settings, and
then configure AWS WAF to block the requests.

To create and configure a SqlInjectionMatchSet, perform the following
steps:

Action: Whether to insert the object into or delete the object from
the array. To change a SqlInjectionMatchTuple, you delete the existing
object and add a new one.

FieldToMatch: The part of web requests that you want AWS WAF to inspect
and, if you want AWS WAF to inspect a header, the name of the header.

TextTransformation: Which text transformation, if any, to perform on
the web request before inspecting the request for snippets of malicious SQL code.

You use SqlInjectionMatchSet objects to specify which CloudFront requests
you want to allow, block, or count. For example, if you're receiving requests that
contain snippets of SQL code in the query string and you want to block the requests,
you can create a SqlInjectionMatchSet with the applicable settings, and
then configure AWS WAF to block the requests.

To create and configure a SqlInjectionMatchSet, perform the following
steps:

Action: Whether to insert the object into or delete the object from
the array. To change a SqlInjectionMatchTuple, you delete the existing
object and add a new one.

FieldToMatch: The part of web requests that you want AWS WAF to inspect
and, if you want AWS WAF to inspect a header, the name of the header.

TextTransformation: Which text transformation, if any, to perform on
the web request before inspecting the request for snippets of malicious SQL code.

You use SqlInjectionMatchSet objects to specify which CloudFront requests
you want to allow, block, or count. For example, if you're receiving requests that
contain snippets of SQL code in the query string and you want to block the requests,
you can create a SqlInjectionMatchSet with the applicable settings, and
then configure AWS WAF to block the requests.

To create and configure a SqlInjectionMatchSet, perform the following
steps:

Inserts or deletes ActivatedRule objects in a WebACL. Each Rule
identifies web requests that you want to allow, block, or count. When you update a
WebACL, you specify the following values:

A default action for the WebACL, either ALLOW or BLOCK.
AWS WAF performs the default action if a request doesn't match the criteria in any
of the Rules in a WebACL.

The Rules that you want to add and/or delete. If you want to replace
one Rule with another, you delete the existing Rule and
add the new one.

For each Rule, whether you want AWS WAF to allow requests, block requests,
or count requests that match the conditions in the Rule.

The order in which you want AWS WAF to evaluate the Rules in a WebACL.
If you add more than one Rule to a WebACL, AWS WAF evaluates
each request against the Rules in order based on the value of Priority.
(The Rule that has the lowest value for Priority is evaluated
first.) When a web request matches all of the predicates (such as ByteMatchSets
and IPSets) in a Rule, AWS WAF immediately takes the corresponding
action, allow or block, and doesn't evaluate the request against the remaining Rules
in the WebACL, if any.

Use GetChangeToken to get the change token that you provide in the ChangeToken
parameter of an UpdateWebACL request.

Submit an UpdateWebACL request to specify the Rules that
you want to include in the WebACL, to specify the default action, and
to associate the WebACL with a CloudFront distribution.

Be aware that if you try to add a RATE_BASED rule to a web ACL without setting the
rule type when first creating the rule, the UpdateWebACL request will fail
because the request tries to add a REGULAR rule (the default rule type) with the specified
ID, which does not exist.

For more information about how to use the AWS WAF API to allow or block HTTP requests,
see the AWS WAF Developer
Guide.

Inserts or deletes XssMatchTuple objects (filters) in an XssMatchSet.
For each XssMatchTuple object, you specify the following values:

Action: Whether to insert the object into or delete the object from
the array. To change a XssMatchTuple, you delete the existing object
and add a new one.

FieldToMatch: The part of web requests that you want AWS WAF to inspect
and, if you want AWS WAF to inspect a header, the name of the header.

TextTransformation: Which text transformation, if any, to perform on
the web request before inspecting the request for cross-site scripting attacks.

You use XssMatchSet objects to specify which CloudFront requests you
want to allow, block, or count. For example, if you're receiving requests that contain
cross-site scripting attacks in the request body and you want to block the requests,
you can create an XssMatchSet with the applicable settings, and then
configure AWS WAF to block the requests.